CVE-2009-0367

Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote code execution by exploiting whitelisted module hierarchy

• CVSS 9.3
• CWE-264
• Authentication, Authorization, and Session Management
• Remote

The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module, then using a hierarchical module name to access the unsafe module through the whitelisted module.

CVE

CVE-2009-0367

CWE

CWE-264

CVSS base score

9.3

Published

2009-03-05

OWASP

A04 Insecure Design

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Wesnoth to version 1.5.11 or higher.

class Sandbox:
    def __init__(self):
        self.whitelisted_modules = ['Module']

    def import_module(self, module_name):
        return __import__(module_name)

class Module:
    def __init__(self):
        self.module = __import__('os')

    def execute_command(self, command):
        return self.module.system(command)

sandbox = Sandbox()
module = sandbox.import_module('Module')
instance = module.Module()
instance.execute_command('echo !')

class Sandbox:
    def __init__(self):
        self.whitelisted_modules = ['Module']

    def import_module(self, module_name):
        if module_name not in self.whitelisted_modules:
            raise ValueError(f"Module '{module_name}' is not allowed")
        return __import__(module_name)

class Module:
    def __init__(self):
        self.allowed_functions = ['command']

    def execute_command(self, command):
        if any(char in command for char in [';', '&', '|', '`', '>', '<', '$']):
            raise ValueError("Command contains characters")
        print(f"Executing command: {command}")

sandbox = Sandbox()
module = sandbox.import_module('Module')
instance = module.Module()
instance.execute_command('echo Hello, World!')

@misc{vaitp:cve20090367,
  title        = {{Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote code execution by exploiting whitelisted module hierarchy}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2009},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2009-0367},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2009-0367/}}
}